Author policy. Enforce it on-device.

Write rules in a typed DSL, replay them against past sessions before you ship, then enforce on every machine — locally, at the agent loop, with zero round-trips.

$ forg policy --replay
# replaying 90d sessions against policy.forg
deny tool.fs.write
  when path not_in repo
deny mcp.call
  when server.trust < "verified"
────────────────────────────
sessions  9,712   replayed
matched   84  would block
ready     deploy policy 

Typed DSL

A structured rule language with type-checking — author policy that can't silently go wrong.

Replay sessions

Test a rule against 90 days of real sessions before it goes live. Ship policy you trust.

Policy packs

Bundle rules into shareable packs your whole org can adopt in a single click.

Policy runs where the agent runs

No round-trip to a server to decide if a call is allowed. Rules evaluate in milliseconds, locally, with the same typed DSL your whole team authors from the dashboard.

policy.forg · example

# block writes outside repo
deny tool.fs.write
  when path not_in repo

# require verified servers
deny mcp.call
  when server.trust < "verified"

# scrub secrets before send
scrub request.body
  pattern secrets.*